A mass-assignment attack abuses automatic request-to-model mapping. When an API blindly binds client-supplied properties to a database model, attackers can change fields that should remain server-controlled. section 4.6.1
Changing a payment status
A payment endpoint should accept details such as amount and currency, while the server controls the payment status. If it constructs a payment model from the entire JSON body, a request containing "status": "accepted" may override that protected field. Similar changes could affect order status, discounts, loyalty points, or access privileges. section 4.6.1
Prevent the flaw by defining an input schema containing only client-writable fields, then constructing the database model from that constrained object. Keep generated identifiers, workflow status, and other sensitive attributes outside the accepted request.
Use these checks when reviewing an API:
- Test whether a request can modify payment status, privileges, discounts, or other business-critical fields. section 4.6.1
